Category Archives: Compliance

We all love stories. All of us. We love to hear about good overcoming evil – the prince saving the princess, the bad guy that's captured by the good guy. In short, what we love are fairy tales. The reality is we do not live in a world of fairy tales and sometimes, yeah, the bad guys do win. The prince, admired by many, is not such a good prince after all. We trust without knowing they can be trusted. So, what does this have to do with audits?

Businesses are built based on one concept – to solve a customer's problem. You are their hero to save whatever pain they have or problem they can't seem to overcome. You, are (as the story goes) their knight in shining armour. Your customer needs someone to deliver a solution, you are just the good guy to do it.

Fast forward a couple years, your business is booming, your customers are happy, and in walks every IT nightmare…the auditor. Eye glasses the size of saucers, a necktie tied just a shade too short, and a laugh that is about as annoying as a nail on a chalkboard; you are succumbed to a software audit.

How do you defend such evil? The biggest mistake a hosting partner (or enterprise's in general) often makes is being fearful. They give the auditors everything they ask. That's not always bad, but if you don't understand why they are asking for certain things or feel they are painting you in a corner, take a step back. Don't give in without understanding what they are asking and why. Why do they want to know who your customers are? Why do they ask about customer owned licenses? Software Assurance? Historical information? If you can't answer "why" maybe you need help. In walks SPLA Man. Nah, in walks Mrs. SPLA Man, every auditor's worst nightmare. She put together the following list on how to better prepare yourself for the unexpected.

Mrs. SPLA Man's List

Don't be fearful – no matter what, it's your business and YOUR customers.

Have a plan. Know what's in your customer agreements. If you need to refresh your agreement language, do it. Software licensing rules change daily, if you have not updated your contracts on license mobility or datacenter outsourcing, update it now.

Don't bring unwanted attention to your organization. Always report usage on time and pay on time. 80% of all delinquent reporting has nothing to do with the reseller or Microsoft. It has everything to do with a SPLA partner's account payable dept.

Don't have one person manage your usage reporting. In a lot of cases, a person leaves a company who was the only one who worked with the reseller directly. When that person leaves, who is responsible for reporting?

Don't be pressured. Audits can take up a lot of resources. Don't give up customer engagements to satisfy an auditor. Your customers are the lifeblood of your business, don't delay meetings with your clients.

The publisher needs you. You are their sales arm. You bring the hybrid cloud to life.

Find out from the publisher who manages your account. When was the last time you spoke to them about strategy or best practices?

Relax. It's not the IRS auditing you (yet)

Don't settle just to settle. You didn't grow your business to the magnitude you've grown it without having negotiating skills (and guts).

Don't be scared to ask for help. Have a question? Email info@splalicensing.com

Jimbo had a small IT firm for which he provided backup, security, and hosting for two clients. He also purchased Office 365 licenses for a handful of users directly from the Microsoft Office 365 website and would bill them accordingly. Jimbo also had an application he tried to develop to help end users better communicate with one another. It was similar to SharePoint, but more seamless and had better integration with third-party applications. He had a SPLA, and had one person who submitted their usage report to their reseller. Unfortunately, that person got sick and passed away. Jimbo was sad and so was the rest of the staff.

To put his mind at ease, he spent every waking hour improving his application. He thought it was going to be the next best thing. I experienced the application firsthand myself, and found it to be a powerful tool. I even asked to invest in it, but without any money, (Mrs. SPLA Man spent it all at Target), I had nothing to invest with.

Fast forward a year later. Jimbo is still working on improving the application, and he's still hosting. One day, Jimbo received an email from Microsoft. It was titled “Self-Audit”, Jimbo was getting audited. One thing left unmentioned, Jimbo is the nicest guy on the planet. He replied to Microsoft and in the end, provided them with everything. All his server information, customer name, and reporting history. It was an auditor’s dream.

Several weeks later, Microsoft provided Jimbo with the findings. He owed $450,000 in unreported licensing fees. Why so high? No usage was being reported since the lady who reported SPLA passed away. When she was reporting, she reported the wrong thing. Instead of licensing Windows Datacenter, she reported Standard. Instead of reporting physical processors and/or cores, she reported per VM. Everything was a mess. Jimbo, who neglected his hosting practice for months to focus on his application, was left feeling very uncertain about his future. He did not have the funds to pay for licenses.

It’s unfortunate, but Jimbo had to shut down his hosting business. The application he built? Stopped. He tried to sell it, and last I heard very few were interested.

Why such a depressing story and was it true? Yes, the story is true (although slightly embellished). Why share it? I am telling you the story because there are too many organizations doing the same thing. They have one person who manages the licenses, one person who was in contact with the reseller, and one person who knew what they were reporting. What happens if that person leaves? Too many organizations are also buying Office 365, but not getting the best discount.

Licensing is challenging, and in the case of Jimbo, his love wasn’t reporting usage, it was developing an application. He should have had allocated resources to help manage his SPLA, so he could focus on what he knows best, the technology.

I am always asked why I created splalicensing.com and what's so different about SPLA Man than other blogs. I think the main difference is honesty. I am your licensing Siri or Alexa. I am SPLAlexa. (that was bad). Don’t be Jimbo.

The year 2017 has brought on A LOT of change for the hosting community. A hosting company used to be an organization that hosted Exchange – fast forward to today and a service provider takes on a whole new meaning. In this article, we will take a look at defining a service provider and how it applies to licensing. Let’s play a little game called “Do they qualify” Have a question? Email info@splalicensing.com

An organization that provides or extends litigation software (that they leased from the publisher) to law firms and other legal entities who are not wholly owned by the organization providing the solution. Does this organization qualify for SPLA?

Yes. If you are an avid reader of splalciensing.com, you probably read my article on EMR Software The same holds true for any software (not just EMR) that runs on Microsoft technology that you do not own, but lease from a third-party. Remember “AS” If you are providing software AS a service that’s hosted from your datacenter environment, SPLA must be part of the equation. Why does this solution qualify for SPLA?

#1 they don’t own the software they are hosting

#2 they do not own the organization(s) who are consuming (using) the software for their benefit.

An organization who sells a product on a website to external users – do they qualify for SPLA?

No. Although they are selling something to consumers via the internet, the software used to deploy the solution benefits the e-commerce company, not the end-user. Where SPLA does fit is if the web company decides to host a website on behalf of another organization. The web company would fall under the SPLA rules. Who benefits from the access is a key question to ask yourself. Second question – is the access used to run their business or my own?

An organization who provides SharePoint to end users to share information. Do they qualify?

No. Simply sharing information does not qualify. If the organization was hosting SharePoint on behalf of another organization, that’s SPLA.

A company hosts Exchange on behalf of another organization but does not charge for this access. Does this qualify for SPLA?

Yes. Microsoft doesn’t care how much money you make from the solution. The question remains – are you providing this “as a service” for a third-party?

A company decides to use AWS as their datacenter provider to host an application they use internally. Do they need SPLA?

No. In this example, you are the end-user. AWS has a SPLA to cover all infrastructure products they host on your behalf. If you were to use AWS as a datacenter provider to host SharePoint to your end customers employees; you would pay AWS for Windows and SQL and report on your SPLA SharePoint SAL licenses.

I have 25 Linux machines that I host for my customers. Do I need SPLA?

No. You have 25 Linux machines. If you had 24 Linux machines and 1 Windows VM, you would have to license the host machine to cover that Windows VM through SPLA.

My reseller told me I didn’t need SPLA because the access qualifies for Self-Hosted. The auditors told me it does not qualify. Why?

All software used to deploy the solution has to be self-hosted eligible. I bet you are running an application that does not qualify as part of your solution. This would be SPLA. Secondly, if you did not buy the software with software assurance, that is out of compliant.

There are so many license changes and gotchas with SPLA, Azure, AWS, and all the others that I thought I would highlight for you some of the trends we see when it comes to compliance.

Licensing Office Standard when Office Professional is installed. In many cases, an IT administrator will inadvertently install Office Pro, report Office Standard to their procurement team who in return reports it to the reseller. The IT admin will leave the company, and the procurement team continues to report Standard not knowing Pro is installed until audit time. In this situation, Microsoft will check when Office was installed, and take the delta of what was reported (STD) v. what should be reported (Pro). Don’t make this mistake. Many partners are only charging their customers for Standard pricing!

Not reporting SPLA at all. Sounds silly, but many providers focus on developing software and not on the licensing. We have found instances in which the procurement manager (who was in charge of reporting SPLA) left the organization and no one else took over their responsibility. The reseller continues to email the procurement manager but obviously the email goes unnoticed. After many months, their SPLA will be terminated and all licenses will have to be trued up. The problem with this scenario is not just unexpected licensing expense, but when your SPLA terminates, you must sign a new one. When you sign a new SPLA, you must adhere to the latest SPUR use rights. As an example, if you had a SPLA prior to the Windows core licensing change, you could continue to report processors. If your SPLA terminates, you would be forced to license by core now instead of later when your previous agreement (that is now terminated) expired.

Using a VL copy of Office to deploy Shared Computer Activation (SCA). SCA is specific to Office 365. If you install Office Pro Plus VL, it goes against the product use rights in which Office (without SCA) cannot be installed on shared hardware. It takes a lot of negotiation power and time to prove you are SCA eligible, the customer purchased Office 365, and you inadvertently installed the wrong product.

Using License Mobility without License Mobility. This is by far the most popular compliance trend. Many organizations do not know what is installed in their datacenter when it comes to customer owned licenses. Be sure to have the right documentation, addendum, and licensing to ensure compliance.

Leasing an application, hosting the application, and purchasing volume licensing agreement to offer software as a service. A healthcare company may lease an EMR application, host the application to other healthcare organizations, and license the infrastructure through volume licensing. If your organization does not own the application you are hosting, you must license it through SPLA. Self-Hosted for ISV is only eligible for providers who develop and own the application. This means the code, the rights, everything must be owned by the organization. Leasing the application and using other plugins you may have developed does not qualify.

I hope this provides you a little insight into the world of compliance. If you find yourself out of compliant, let us know and we can connect you to the right resource. info@splalicensing.com

The healthcare community has increased concerns with the way they have deployed (and licensed) their electronic medical record (EMR) software such as Epic Community Connect and others. As a reader of this blog, you know that when you deploy software for the benefit of a third party (non employee) SPLA must be part of the conversation. The only exception to this rule is if you actually own the code to the software you are hosting. In other words, if you developed the software, you can use your own volume licenses to host your software. If you host a third party software (such as Epic) you must license this in SPLA. In most cases, many healthcare companies do not own the application, but lease it from the EMR vendor.

Rewind a few years and let’s pretend you are a large hospital who partnered with Epic to provide best in class patient record management for your clients, doctors, and other clinics. Your Epic deployment resides on a Windows Server, SQL Server, and RDS. As the IT director, you purchased several server licenses and hundreds of Client Access Licenses (CAL) to cover all the external users. You think you are covered; no one mentions you need to license this via SPLA. Your reseller didn’t tell you, Microsoft didn’t tell you, and for that matter the vendor didn’t tell you. You think all is well based off the information you received. Fast forward 3 years and your volume licensing agreement is up for renewal. Someone on the licensing side informs you that you shouldn’t true-up licenses or renew your agreement under volume licensing, you need to license SPLA. You think that’s fine, if you must license under a different program who are you to argue. But what about all those license you already purchased and own? Unfortunately, you cannot return them, you must allocate those internally. You think to yourself that’s fine, except for one minor detail…. you purchased hundreds of CALs and you do not have hundreds of employees; those license you own are essentially worthless. On top of everything else, you just received an audit notification.

Why would they receive an audit notification? Once a vendor recognizes you have been under-licensed, the vendor might want to dig in deeper to see how long you have been out of compliant and if you purchased enough licenses to cover all the users. In 90% of all audits, the customer is under-licensed. Now you own licenses you don’t need, but should’ve purchased more because you don’t own enough licenses to cover all external users initially. The vendor will want you to pay the delta of what you should’ve paid under SPLA and what you purchased under volume licensing (plus an audit fee).

If you are a healthcare provider and have been notified by Microsoft or any other vendor, please contact us. We have found that in many cases the licenses report is not always 100% accurate.

Brett’s Hosting’s sales director is consistently looking on the web to see what competition is advertising. It drives him nuts to see other “hoster’s” advertise SharePoint for less than what he can get directly from his reseller. He’s upset..big time. How can this be? Then he stumbles upon the Microsoft Office 365 website. He blew a gasket. “There is no way I can compete! I am going to go out of business!”

So the sales director decided to get creative. “I will forgo SPLA and just have my customers purchase SharePoint. They bring it into my datacenter, I won’t report SPLA anymore.” So that’s what he did. He started selling SharePoint by the truckload. Their reseller kept placing orders for him as they’d joyfully ask “how many CAL’s do you need?” and they would order it; never once asking what it was for.

Brett’s Hosting did a tremendous job marketing their SharePoint offering. “No SharePoint…No Problem!” It was marvelous. The CEO of Brett’s Hosting vociferously announced at the World Partner Conference “We are hosting over 10,000 SharePoint sites!” The celebration continued. Then one foggy October morning, the office manager for Brett’s Hosting received a letter from Microsoft. She excitedly opened it thinking they were being promoted as ‘SharePoint Partner of the Year’ but was severely disappointed. It was an audit letter. The story turns.

Brett’s Hosting CEO reviewed the letter and then called in their sales director (now sales VP). The CEO threatened him with his job unless he fixed this mess. The sales director/VP was at a loss. “Where did I go wrong.”

To be continued….

Where do you think he went wrong? Have you ever been given wrong licensing advice? You don’t need to answer that, I already know.

Hosting industry has changed. Competition has changed. End users have changed. In my experience, the conversation has changed from “how do I license Windows” to “what are ways I can optimize my licensing spend?” I’ve written about license mobility; I also reviewed SAL for SA. Those two programs have a common theme – Software Assurance (SA). In the above fictitious story, the sales person should’ve asked his customer “do you have SA on these licenses” That question is important because if they do not have SA, the entire environment (hardware/VM) must be dedicated.

I can’t stress this enough. The hosting game is getting brutal. Every service provider is looking for a way to cut/reduce costs. Getting in compliance hot water is not a good way to do that. If the customer does not have SA, you can certainly use SPLA in its place. If you go this route, be sure to make it a bundled solution. Telling customers they must pay for something they already own is not an easy conversation.

The customer can also purchase SA. You just have to be ready to clearly explain their options. That’s why it’s important to work with a reseller that understand SA benefits to help educate and coach you through the process; not all products are eligible. Be prepared.

Story continued…

The sales vp went back to his customers and asked them to purchase Software Assurance. When the customer asked “why?” all the sales vp could say is “because Microsoft told me you needed it.” (he clearly couldn’t explain why…it only made the customer more upset). The customer simultaneously yelled and slammed the door – “I’m going to Joe’s Hosting! They advertise VDI too!”

The sales vp went back to his CEO and was forced to resign. The customer went to Joe’s Hosting and was very happy for over a year. When out of the blue he received a call from his sale rep from Joe’s Hosting. The sales rep frantically told him they could no longer offer VDI; it apparently is not available under SPLA. The sales rep also asked him to buy SA for his SharePoint…”Microsoft told me you needed it!” The customer loses again!

Moral of the story – read the SPUR, read the PUR, and don’t be afraid to ask “Do you want SA with that?”

Like this:

Here’s a list of common mistakes service providers make when reporting SPLA. Don’t say we didn’t warn you!

Reporting only (1) 2 core pack (must report a minimum of 4 cores)

Office without RDS

CRM without SQL

SharePoint without SQL

Reporting SharePoint Enterprise without reporting Standard

Miss combination of Windows and SQL

Agreement without Windows Server

Reporting SQL processors on a recently signed agreement

Using SQL Web to support a line of business application

Reporting less than $100 on a recently signed agreement.

I understand there are many more, but this is a list you can control month end and month out. More difficult licensing errors to correct include: hosting SPLA on servers that are also consumed internally; installing SPLA software on hardware you don’t control or have access; and using System Center to manage both internal and external facing applications.